Failures to load fips provider result in cryptic error due to bundling of conditionals
#24,179 opened on 2024年4月18日
Repository metrics
- Stars
- (30,157 stars)
- PR merge metrics
- (30d に merged PR はありません)
説明
One of the common issues I've run into dealing with the FIPS provider is that the error handling in selftest.c isn't incredibly helpful. In particular, this line bundles together 2 conditionals to ensure the second conditional doesn't result in a SIGSEGV from a NULL pointer dereference... https://github.com/openssl/openssl/blob/e1fd043ad7fa865a8ef9160c892b49a098d23c71/providers/fips/self_test.c#L338-L339
This results in this cryptic error though:
+ env 'OPENSSL_CONF=$PWD/ossl_cnf_43Rk3C' openssl list -provider fips
list: unable to load provider fips
Hint: use -provider-path option or OPENSSL_MODULES environment variable.
00206134EF5C0000:error:1C8000D5:Provider routines:SELF_TEST_post:missing config data:/usr/src/crypto/openssl/providers/fips/self_test.c:275:
00206134EF5C0000:error:1C8000E0:Provider routines:ossl_set_error_state:fips module entering error state:/usr/src/crypto/openssl/providers/fips/self_test.c:373:
00206134EF5C0000:error:1C8000D8:Provider routines:OSSL_provider_init_int:self test post failure:/usr/src/crypto/openssl/providers/fips/fipsprov.c:707:
00206134EF5C0000:error:078C0105:common libcrypto routines:provider_init:init fail:/usr/src/crypto/openssl/crypto/provider_core.c:932:name=fips
Separating out the two conditionals would (at the very least) allow end-users to better determine what condition is causing the fips provider to not load. (in my particular scenario, it's the second case that's failing)
Contents of $OPENSSL_CONF
config_diagnostics = 1
# NB: the full path was omitted on purpose.
.include ${ENV::PWD}/ossl_cnf_43Rk3C.fips
openssl_conf = openssl_init
# Need to specify the absolute path here.
[openssl_init]
providers = provider_sect
# Load base + fips (default doesn't jive with fips).
[provider_sect]
base = base_sect
fips = fips_sect
[base_sect]
activate = 1
"fipsmodule.cnf" (ossl_cnf_43Rk3C.fips)
[fips_sect]
activate = 1
install-version = 1
conditional-errors = 1
security-checks = 1
module-mac = 61:78:FA:4A:37:53:45:AE:3E:59:D6:6B:4A:AD:B1:6E:66:1F:98:AF:7B:F8:CC:04:35:44:B7:69:84:6D:F9:B9
install-mac = 41:9C:38:C2:8F:59:09:43:2C:AA:2F:58:36:2D:D9:04:F9:6C:56:8B:09:E0:18:3A:2E:D6:CC:69:05:04:E1:11
install-status = INSTALL_SELF_TEST_KATS_RUN